azureaksPractitioner

Unlocking Azure Kubernetes Service with Microsoft Entra Workload ID

5 min read Microsoft LearnApr 26, 2026Reviewed for accuracy

Practitioner — Hands-on experience recommended

In modern cloud-native architectures, managing identities and access securely is paramount. Microsoft Entra Workload ID addresses this need by allowing Kubernetes workloads to authenticate seamlessly with Azure resources. This integration not only simplifies identity management but also enhances security by leveraging federated identities. By assigning workload identities, you can ensure that your applications running in AKS can access necessary Azure services without hardcoding credentials.

The mechanism is straightforward yet powerful. AKS acts as the token issuer, utilizing OpenID Connect (OIDC) to verify service account tokens. When your application needs to access Azure resources, it exchanges the service account token for a Microsoft Entra token. This is done using the Azure Identity client library or the Microsoft Authentication Library (MSAL). You’ll need to annotate your service accounts correctly, and remember that any changes to these annotations require a pod restart to take effect. Additionally, keep in mind that you can have a maximum of 20 federated identity credentials per managed identity, and it may take a few seconds for new credentials to propagate.

In production, be aware of some caveats. Ensure your AKS version is 1.22 or higher, and that you're using Azure CLI version 2.47.0 or later. The virtual nodes add-on is not supported with this setup, and federated identity credential creation is limited in certain regions. These nuances can trip up even seasoned engineers, so stay vigilant about your configurations and environment specifics.

Key takeaways

→Leverage Microsoft Entra Workload ID for secure Azure resource access from AKS.
→Use Service Account Token Volume Projection to enable Kubernetes identities in your pods.
→Remember to restart pods after updating service account annotations for changes to take effect.
→Limit federated identity credentials to 20 per managed identity to avoid authentication issues.
→Ensure AKS and Azure CLI versions meet the minimum requirements for proper functionality.

Why it matters

In production, managing identities securely can prevent unauthorized access and reduce the risk of credential leaks. This integration allows for a more streamlined and secure approach to identity management in Kubernetes environments.

Code examples

.NET

1using Azure.Identity;
2using Azure.Security.KeyVault.Secrets;
3
4string keyVaultUrl = Environment.GetEnvironmentVariable("<key-vault-url>");
5string secretName = Environment.GetEnvironmentVariable("<secret-name>");
6
7var client = new SecretClient(
8    new Uri(keyVaultUrl),
9    new DefaultAzureCredential());
10
11KeyVaultSecret secret = await client.GetSecretAsync(secretName);

Python

1import os
2
3from azure.keyvault.secrets import SecretClient
4from azure.identity import DefaultAzureCredential
5
6def main():
7    keyvault_url = os.getenv('<key-vault-url>', '')
8    secret_name = os.getenv('<secret-name>', '')
9
10    client = SecretClient(vault_url=keyvault_url, credential=DefaultAzureCredential())
11    secret = client.get_secret(secret_name)
12
13if __name__ == '__main__':
14    main()

Java

1import java.util.Map;
2
3import com.azure.security.keyvault.secrets.SecretClient;
4import com.azure.security.keyvault.secrets.SecretClientBuilder;
5import com.azure.security.keyvault.secrets.models.KeyVaultSecret;
6import com.azure.identity.DefaultAzureCredentialBuilder;
7import com.azure.identity.DefaultAzureCredential;
8
9public class App {
10    public static void main(String[] args) {
11        Map<String, String> env = System.getenv();
12        String keyVaultUrl = env.get("<key-vault-url>");
13        String secretName = env.get("<secret-name>");
14
15        SecretClient client = new SecretClientBuilder()
16                .vaultUrl(keyVaultUrl)
17                .credential(new DefaultAzureCredentialBuilder().build())
18                .buildClient();
19        KeyVaultSecret secret = client.getSecret(secretName);
20    }
21}